
honeypot-data
Public honeypot datasets and observation reports with HTTP/TLS fingerprint data (JA3/JA4), pseudonymized source IPs, and exploitation attempt…

Public honeypot datasets and observation reports with HTTP/TLS fingerprint data (JA3/JA4), pseudonymized source IPs, and exploitation attempt…

Packet capture artifacts of plex2shell exploitation against Plex, including lab and in-the-wild traffic, for building and validating detection…

Collection of Python and Perl scripts for digital forensics, incident response, and network analysis, including hash signature tooling and packet…

Indicators of Compromise and hunting guidance for CVE-2026-88771, an unauthenticated command injection in Citrix NetScaler ADC and Gateway, covering…

Offline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…

Wireshark RDP resources

Selective protocol extractor from PCAPs or interfaces

A collection of scripts for processing network forensics type data and intelligence, mainly into a postgres database.

A Zeek STUN protocol analyzer based on Spicy.

A curated collection of DFIR skills and workflows for InfoSec practitioners.


Incident response walkthrough analyzing CVE-2023-46604 exploitation of Apache ActiveMQ via OpenWire, including PCAP analysis, IOC identification, and…

Offline AI Security Assistant for Air-Gapped Pentesting

Pcap (capture file) Analysis Toolkit(v.1)

Multiplatform C++ library for high-performance network packet capture, parsing, crafting, and analysis. Supports libpcap, DPDK, AF_XDP, PF_RING, and…

This framework combines a set of existing open source tools into an integrated package that automates the forensics investigation process. It is able…

Dshell is a network forensic analysis framework.